gustavohsr
(usa Debian)
Enviado em 29/10/2010 - 15:55h
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ipt_LOG
modprobe ipt_state
modprobe ipt_MASQUERADE
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
#####################################
##### Definição de Policiamento #####
#####################################
# Tabela filter
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD DROP
# Tabela nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
# Tabela mangle
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
#PSAD
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
##### Proteção contra IP Spoofing #####
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 >$i
done
##### Ativamos o redirecionamento de pacotes (requerido para NAT) #####
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "8192" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
###############################################################
# Tabela filter #
###############################################################
#######################
##### Chain INPUT #####
#######################
# Criamos um chain que será usado para tratar o tráfego vindo da Internet e
iptables -N eth1-input
# Aceita todo o tráfego vindo do loopback e indo pro loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -I INPUT -i ! lo -s 127.0.0.0/255.0.0.0 -j DROP
# Todo tráfego vindo da rede interna também é aceito
iptables -A INPUT -s 192.168.1.0/24 -i eth0 -j ACCEPT
# Conexões vindas da interface eth1 são tratadas pelo chain eth1-input
iptables -A INPUT -i eth1 -j eth1-input
#Bloquear Spammers
iptables -A INPUT -p tcp -s ! 192.168.0.0/16 --dport 3128 -j REJECT
#BLOQUEAR SERVIÇO POP E SMTP - OUTLOOK
iptables -A INPUT -p tcp -i eth0 -m multiport --dport 110,25 -j DROP
#Abre porta para servidor DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 200.200.200.200/32 -j ACCEPT
iptables -A INPUT -s 201.201.201.201/32 -j ACCEPT
#Libera a entrada de conexões iniciadas pela máquina
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#Teste de bloqueio da porta 80
#iptables -A INPUT -i eth1 --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j REJECT
#BLOQUEAR TCP PARA PORTA 80 MENOS DO SERVIDOR
iptables -A INPUT -m tcp -p tcp -s ! 192.168.0.0/16 --dport 80 -j DROP
iptables -A INPUT -m tcp -p tcp -s ! 192.168.0.0/16 --dport 8080 -j DROP
# Descarta pacotes malformados, protegendo contra ataques diversos
iptables -A INPUT -m state --state INVALID -j DROP
#Bloqueia o restante
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -i eth1-input -j DROP
#########################
##### Chain FORWARD #####
#########################
#Contra ataques de syn-flood
iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
#Contra ping da morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
#Contra port scan ocultos
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
# Permite redirecionamento de conexões entre as interfaces locais
# especificadas abaixo. Qualquer tráfego vindo/indo para outras
# interfaces será bloqueado neste passo
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -j ACCEPT
#BLOQUEAR SERVIÇO POP E SMTP - OUTLOOK
iptables -A FORWARD -p tcp -i eth0 -m multiport --dport 110,25,995,993,465,587 -j DROP
iptables -A FORWARD -p tcp -i eth0 -m multiport --sport 110,25,995,993,465,587 -j DROP
#########################
##### Chain OUTPUT #####
#########################
#Aceita trafego em lo (saida)
iptables -I OUTPUT -o lo -j ACCEPT
#Saida DNS para servidores do empresa-MG
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -d 200.200.200.200/32 -j ACCEPT
iptables -A OUTPUT -d 201.201.201.201/32 -j ACCEPT
############################
##### Chain eth1-input #####
############################
iptables -A eth1-input -p icmp -m limit --limit 2/s -j ACCEPT
iptables -A eth1-input -p tcp --dport 22 -j ACCEPT
# A tentativa de acesso externo a estes serviços serão registrados no syslog
# do sistema e serão bloqueados pela última regra abaixo.
iptables -A eth1-input -p tcp --dport 80 -j LOG --log-prefix "FIREWALL: www"
iptables -A eth1-input -p tcp --dport 21 -j LOG --log-prefix "FIREWALL: ftp "
iptables -A eth1-input -p tcp --dport 25 -j LOG --log-prefix "FIREWALL: smtp "
iptables -A eth1-input -p udp --dport 53 -j LOG --log-prefix "FIREWALL: dns "
iptables -A eth1-input -p tcp --dport 110 -j LOG --log-prefix "FIREWALL: pop3 "
iptables -A eth1-input -p tcp --dport 113 -j LOG --log-prefix "FIREWALL: identd "
iptables -A eth1-input -p udp --dport 111 -j LOG --log-prefix "FIREWALL: rpc"
iptables -A eth1-input -p tcp --dport 111 -j LOG --log-prefix "FIREWALL: rpc"
##################
##### OUTPUT #####
##################
#DNS
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
#######################################################
# Tabela nat #
#######################################################
#############################
##### Chain POSTROUTING #####
#############################
# Permite qualquer conexão vinda com destino a lo e rede local para eth1
iptables -t nat -A POSTROUTING -o lo -j ACCEPT
#REGRA ABAIXO NAO FUNCIONANDO COM HTTPS
#iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j ACCEPT
# AVAST
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d avast.com -j MASQUERADE
# É feito masquerading dos outros serviços da rede interna indo para a interface eth1
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
############################
####### PREROUTING #########
###########################
#Não passar estes sites pelo proxy
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 --dport 80 -d sistec.mec.gov.br -j RETURN
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 --dport 80 -d ssd.mec.gov.br -j RETURN
#Proxy transparente
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -i eth0 -j REDIRECT --to-port 3128
###############################################
# Tabela mangle #
###############################################
########################
##### Chain OUTPUT #####
########################
iptables -t mangle -A OUTPUT -o eth1 -p udp --dport 53 -j TOS --set-tos 0x10
########################
#### Chain FORWARD #####
########################
iptables -t mangle -A FORWARD -p udp --dport 53 -j TOS --set-tos 10
#Definindo Maximo Processamento a pacotes http e https: Pacotes com tamanho até 1024 bytes
iptables -t mangle -A PREROUTING -p tcp --sport 80 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A FORWARD -p tcp --sport 80 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A PREROUTING -p tcp --dport 80 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A FORWARD -p tcp --dport 80 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A PREROUTING -p tcp --sport 443 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A FORWARD -p tcp --sport 443 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A PREROUTING -p tcp --dport 443 -m length --length 1:1024 -j TOS --set-tos 8
iptables -t mangle -A FORWARD -p tcp --dport 443 -m length --length 1:1024 -j TOS --set-tos 8
